The CRUtape Letters™, an Alternative Explanation.

By charles the moderator

Rodin’s The Thinker at the Musée Rodin.

Author CJ. Licensed under Creative Commons.

I have a theory.

With the blogosphere all atwitter about the emails and data “stolen” from the Climatic Research Institute at the University of East Anglia, two theories have become dominant describing the origin of the incident.

1. CRU was hacked and the data stolen by skilled hackers, perhaps an individual or more insidiously some sophisticated group, such as Russian agents.
2. An insider leaked the information to the NSM (non-mainstream media)

Theory number one is the preferred explanation of the defenders of CRU. This allows them to portray CRU as victims of illegal acts. It allows them to scream bloody murder and call for an investigation of the crime. How can we take the fruits of hideous crime seriously?  The end does not justify the means!

One of our favorite writers, Gavin Schmidt, has expanded on this theme with the report:

He  [Gavin] said the breach at the University of East Anglia was discovered after hackers who had gained access to the correspondence sought Tuesday to hack into a different server supporting realclimate.org, a blog unrelated to NASA that he runs with several other scientists pressing the case that global warming is true.

The intruders sought to create a mock blog post there and to upload the full batch of files from Britain. That effort was thwarted, Dr. Schmidt said, and scientists immediately notified colleagues at the University of East Anglia’s Climatic Research Unit.

http://www.nytimes.com/2009/11/21/science/earth/21climate.html

I believe the above statement by Gavin to be a big bunch of hooey. I believe the “hack” was a posting of the same blog comment which was posted at The Air Vent

which was also submitted here at WUWT, but never was visible publicly, because all comments are moderated and publicly invisible until approved by an administrator or moderator.  Many of you have already seen it:

We feel that climate science is, in the current situation, too important to be kept under wraps.

We hereby release a random selection of correspondence, code, and documents.

Hopefully it will give some insight into the science and the people behind it.

This is a limited time offer, download now:

http://ftp.tomcity.ru/incoming/free/FOI2009.zip

Sample:

0926010576.txt * Mann: working towards a common goal

1189722851.txt * Jones: “try and change the Received date!”

0924532891.txt * Mann vs. CRU

0847838200.txt * Briffa & Yamal 1996: “too much growth in recent years makes it difficult to derive a valid age/growth curve”

0926026654.txt * Jones: MBH dodgy ground

1225026120.txt * CRU’s truncated temperature curve

1059664704.txt * Mann: dirty laundry

1062189235.txt * Osborn: concerns with MBH uncertainty

0926947295.txt * IPCC scenarios not supposed to be realistic

0938018124.txt * Mann: “something else” causing discrepancies

0939154709.txt * Osborn: we usually stop the series in 1960

0933255789.txt * WWF report: beef up if possible

0998926751.txt * “Carefully constructed” model scenarios to get “distinguishable results”

0968705882.txt * CLA: “IPCC is not any more an assessment of published science but production of results”

1075403821.txt * Jones: Daly death “cheering news”

1029966978.txt * Briffa – last decades exceptional, or not?

1092167224.txt * Mann: “not necessarily wrong, but it makes a small difference” (factor 1.29)

1188557698.txt * Wigley: “Keenan has a valid point”

1118949061.txt * we’d like to do some experiments with different proxy combinations

1120593115.txt * I am reviewing a couple of papers on extremes, so that I can refer to them in the chapter for AR4

I was the first at WUWT to see the comment above and immediately embargoed it. After discussions and many phone calls, we finally began to refer to the information after, and only after, we saw that it was available elsewhere, such as The Air Vent, and also after we knew that CRU was aware that it was circulating on the web.

Gavin’s elaborate description of the hacking attempt at RC is, in my humble opinion, nothing more than an attempt to add meat to the hacking theory in order to increase the vilification of the theoretical hackers.  Gavin has demonstrated this kind of misdirection in the past in the Mystery Man incident where he attempted to obfuscate his own involvement in a data correction to station files held by the British Antarctic Survey.  In this new spirit of transparency Gavin, why don’t you send Anthony the log files that demonstrate this attempted break in at realclimate.org?

And then Raymond T. Pierrehumbert also weighs in on this poor real-climate-scientist-as-victim meme or point of view.

After all, this is a criminal act of vandalism and of harassment of a group of scientists that are only going about their business doing science. It represents a whole new escalation in the war on climate scientists who are only trying to get at the truth. Think — this was a very concerted and sophisticated hacker attack. …Or at the next level, since the forces of darkness have moved to illegal operations, will we all have to get bodyguards to do climate science?

Sigh…and sigh again.

Theory number two is the preferred explanation of, for want of a better term, the Skeptics Camp.  It is a romantic  thought.  Some CRU employee, fed up with the machinations, deceit, and corruption of science witnessed around him or her, took the noble action of becoming whistle-blower to the world, bravely thrusting the concealed behavior and data into the light for all to see.  This theory is attractive for all the right reasons. Personal risk, ethics, selflessness etc.

I would like to offer a third possibility based on a bit of circumstantial evidence I noticed on the Web Saturday afternoon.

There’s an old adage, never assume malice when stupidity or incompetence will explain it.

A short time ago there was a previous  leak of CRU data by an insider.  In this case, Steve McIntyre acquired station data which he had been requesting for years, but someone inside CRU unofficially made the data available.

In this case, many commentators had various guesses as to the motivation or identity of the disgruntled mole even proposing that perhaps a disgruntled William Connelly was the perpetrator.

Of course it turned out the Phil Jones, director of CRU, himself had inadvertently left the data on an open FTP server.

Many have begun to think that the zip archive FOI2009.zip was prepared internally by CRU in response to Steve McIntyre’s FOI requests, in parallel with attempts to deny the request in case the ability to refuse was lost.  There are many reasons to think this is valid and it is consistent with either of the two theories at the beginning of this post.  Steve McIntyre’s FOI appeal was denied on November 13^th and the last of the emails in the archive is from November 12^th.

It would take a hacker massive amounts of work to parse through decades of emails and files but stealing or acquiring a single file is a distinct possibility and does not require massive conspiracy.  The same constraints of time and effort would apply to any internal whistle blower.  However, an ongoing process of internally collating this information for an FOI response is entirely consistent with what we find in the file.

In the past I have worked at organizations where the computer network grew organically in a disorganized fashion over time.  Security policies often fail as users take advantage of shortcuts to simplify their day to day activities. One of these shortcuts is to share files using an FTP server.  Casual shortcuts in these instances may lead to gaping security holes.  This is not necessarily  intentional, but a  consequence of human nature to take a shortcut here and there. This casual internal sharing can also lead to unintentional sharing of files with the rest of the Internet as noted in the Phil Jones, CRU mole, example above.  Often the FTP server for an organization may also be the organization’s external web server as the two functions are often combined on the same CPU or hardware box.  When this occurs, if the organization does not lock down their network thoroughly, the security breaches which could happen by accident are far more likely to occur.

Since Friday November 20^th a few users noticed this interesting notice on the CRU website.

This website is currently being served from the CRU Emergency Webserver.

Some pages may be out of date.

Normal service will be resumed as soon as possible.

Here is a screen grab for posterity.

So as part of the security crackdown at CRU they have taken down their external webserver? Network security professionals in the audience will be spitting up coffee all over their keyboards at this point.

So this is my theory is and this is only my theory:

A few people  inside CRU possessed the archive of documents being held in reserve in case the FOI appeal decision was made in favor of Steve McIntyre.  They shared it with others by putting it in an FTP directory which was on the same CPU as the external webserver, or even worse, was an on a shared drive somewhere to which the  webserver had permissions to access. In other words, if you knew where to look,  it was publicly available.  Then, along comes our “hackers” who happened to find it, download it, and the rest is history unfolding before our eyes.  So much for the cries of sophisticated hacking and victimization noted above.

If I had to bet money, I would guess that David Palmer, Information Policy & Compliance Manager, University of East Anglia, has an even chance of being  the guilty party, but it would only be a guess.

To repeat the basic premise of this theory.

There’s an old adage, never assume malice when stupidity or incompetence will explain it.

™ CRUtape Letters, is a trademark of Moshpit Enterprises.